The following builds have been pushed to Fedora EPEL 4 updates-testing

spamass-milter-0.3.1-18.el4

Details about builds:

================================================================================ spamass-milter-0.3.1-18.el4 (FEDORA-EPEL-2010-2473) Milter (mail filter) for spamassassin -------------------------------------------------------------------------------- Update Information:

This update includes a fix for a problem where if the milter is running using the "-x" option to expand aliases before passing inbound mail through SpamAssassin, a malicious client using a carefully-crafted SMTP session could execute arbitrary code on the mail server. The fix avoids the use of a shell in the alias expansion and hence there is no longer a problem with having to sanitize input from the client. No CVE number has yet been assigned to this problem, which is tracked upstream at https://savannah.nongnu.org/bugs/?29136 The update also contains improved Received-header-generation for message submission and a fix for a problem where the milter would erroneously log warnings about the mail server's configuration when the first message from a non-authenticated client passed through. As part of the fix for this issue, the required milter macro configuration for the mail server has changed slightly: see the README file included in the package for details. -------------------------------------------------------------------------------- ChangeLog:

* Tue Mar 23 2010 Paul Howarth paul@city-fan.org 0.3.1-18 - Add patch to get rid of compiler warnings - Reorder and re-base patches to optimize chances of upstream accepting them - Improve Received-header patch (#496763) incorporating additional fix from upstream update (http://savannah.nongnu.org/bugs/?17178) * Fri Mar 12 2010 Paul Howarth paul@city-fan.org 0.3.1-17 - Update initscript to support running the milter as root, which is needed for the -x (expand aliases) option; note that the milter does not run as root by default - Add patch for popen unsanitized input vulnerability (#572117, #572119, http://savannah.nongnu.org/bugs/?29136) - Rebase authuser patch - Update patch adding auth info to dummy Received-header so that it doesn't generate spurious warnings about missing macros (#532266), and update and merge the macro documentation patch into this patch - Document patch usage in spec file * Tue Aug 11 2009 Paul Howarth paul@city-fan.org 0.3.1-16 - Switch to bzipped source tarball * Sun Jul 26 2009 Fedora Release Engineering rel-eng@lists.fedoraproject.org 0.3.1-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild * Fri Apr 24 2009 Paul Howarth paul@city-fan.org 0.3.1-14 - Fix Received-header generation (#496763) - Add authentication info to dummy Received-header (#496769) - Add option to skip checks for authenticated senders (#437506, #496767) (thanks to Habeeb J. Dihu for the reports and patches) * Wed Mar 18 2009 Paul Howarth paul@city-fan.org 0.3.1-13 - Call initscripts directly instead of via /sbin/service and fine-tune scriptlet dependencies - Change sa-milt user's home directory from %{_localstatedir}/run/spamass-milter to %{_localstatedir}/lib/spamass-milter so as to retain directory contents across a reboot (#489995), and fix the home directory of any existing sa-milt account on upgrades * Fri Feb 27 2009 Paul Howarth paul@city-fan.org 0.3.1-12 - Subpackage for postfix is now noarch for Fedora 10 onwards - Fix scriptlet deps to ensure that sa-milt user exists before we attempt to add it to the postfix group * Wed Feb 25 2009 Fedora Release Engineering rel-eng@lists.fedoraproject.org 0.3.1-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild * Fri Feb 13 2009 Paul Howarth paul@city-fan.org 0.3.1-10 - Rebuild for shared libmilter in Fedora 11 development * Thu Jul 3 2008 Paul Howarth paul@city-fan.org 0.3.1-9 - Require /usr/sbin/sendmail (for -b/-B/-x options) rather than sendmail pkg - Make summary and description less Sendmail-specific - Add patch to support group-writable socket for MTA communication, needed to be able to use a Unix-domain socket with Postfix (#452248) - Add subpackage with group-writable directory for Postfix support - Tweak initscript to change default options when Postfix socket directory is present - Document additional ENVRCPT macros to provide * Tue May 20 2008 Paul Howarth paul@city-fan.org 0.3.1-8 - Fix initscript failure to start with SELinux in enforcing mode (#447247) (needs selinux-policy >= 3.3.1-55 on F9) * Tue Feb 19 2008 Fedora Release Engineering rel-eng@fedoraproject.org 0.3.1-7 - Autorebuild for GCC 4.3 * Mon Feb 18 2008 Paul Howarth paul@city-fan.org 0.3.1-6 - Rebuild with gcc 4.3.0 for Fedora 9 -------------------------------------------------------------------------------- References:

[ 1 ] Bug #572117 - SpamAssassin Mail Filter: Arbitrary shell command injection (privilege escalation) https://bugzilla.redhat.com/show_bug.cgi?id=572117 --------------------------------------------------------------------------------